merchant: landing-stats + helpers; demo instance note

scripts/taler-merchant/setup_credit_facade.sh

@@ -0,0 +1,91 @@
+#!/bin/bash
+# Configure merchant bank account credit facade for automatic settlement import.
+#
+# Root cause (2026-07-09): merchant wirewatch must call the **Taler Revenue API**
+# (`…/taler-revenue/`), not the exchange wire-gateway (`…/taler-wire-gateway/`).
+# On this bank, history endpoints accept **Bearer** tokens only (Basic → 401).
+#
+# Usage (as root on koopa host):
+#   setup_credit_facade.sh
+#   MERCHANT_INSTANCE=goa-demo-cp4zqk setup_credit_facade.sh
+#   BANK_USER=… BANK_PW_FILE=… MERCHANT_PW_FILE=… setup_credit_facade.sh
+#
+# Effects:
+#   - PATCH /instances/$INST/private/accounts/$H_WIRE with credit_facade_*
+#   - long-lived refreshable bank token (1y)
+#   - restarts taler-merchant-wirewatch (once, after facade is set)
+set -euo pipefail
+
+INST="${MERCHANT_INSTANCE:-goa-demo-cp4zqk}"
+BANK_USER="${BANK_USER:-$INST}"
+MERCHANT_PW_FILE="${MERCHANT_PW_FILE:-/root/merchant-${INST}-password.txt}"
+BANK_PW_FILE="${BANK_PW_FILE:-/root/bank-${BANK_USER}-password.txt}"
+MER_URL="${MERCHANT_URL:-https://127.0.0.1:9010}"
+BANK_URL="${BANK_URL:-http://127.0.0.1:9012}"
+PUBLIC_BANK="${PUBLIC_BANK_BASE:-https://bank.hacktivism.ch}"
+FACADE_URL="${CREDIT_FACADE_URL:-${PUBLIC_BANK}/accounts/${BANK_USER}/taler-revenue/}"
+
+if [ "$(id -un)" != "root" ]; then
+  echo "run as root on koopa host" >&2
+  exit 1
+fi
+if [ ! -r "$MERCHANT_PW_FILE" ] || [ ! -r "$BANK_PW_FILE" ]; then
+  echo "need readable $MERCHANT_PW_FILE and $BANK_PW_FILE" >&2
+  exit 1
+fi
+
+MPW=$(tr -d '\n' <"$MERCHANT_PW_FILE")
+BPW=$(tr -d '\n' <"$BANK_PW_FILE")
+AUTH="Authorization: Bearer secret-token:${MPW}"
+
+echo "=== bank token for $BANK_USER ==="
+TOK=$(curl -sS -u "${BANK_USER}:${BPW}" -H 'Content-Type: application/json' \
+  -d '{"scope":"readwrite","refreshable":true,"duration":{"d_us":31536000000000}}' \
+  "${BANK_URL}/accounts/${BANK_USER}/token" \
+  | python3 -c 'import sys,json;print(json.load(sys.stdin)["access_token"])')
+echo "tok_len=${#TOK}"
+
+echo "=== verify revenue history ==="
+code=$(curl -sS -m 15 -o /tmp/rev-check.json -w "%{http_code}" \
+  -H "Authorization: Bearer ${TOK}" \
+  "${BANK_URL}/accounts/${BANK_USER}/taler-revenue/history?delta=-3")
+echo "revenue_history_http=$code"
+python3 -c 'import json;d=json.load(open("/tmp/rev-check.json"));print("incoming",len(d.get("incoming_transactions")or[]))'
+[ "$code" = "200" ] || { echo "FAIL revenue history"; exit 1; }
+
+echo "=== PATCH credit_facade ($FACADE_URL) ==="
+H_WIRE=$(curl -sk -H "$AUTH" "${MER_URL}/instances/${INST}/private/accounts" \
+  | python3 -c 'import sys,json;print(json.load(sys.stdin)["accounts"][0]["h_wire"])')
+export FACADE_URL TOK
+BODY=$(python3 - <<'PY'
+import json, os
+print(json.dumps({
+  "credit_facade_url": os.environ["FACADE_URL"],
+  "credit_facade_credentials": {"type": "bearer", "token": os.environ["TOK"]},
+}))
+PY
+)
+curl -sk -X PATCH -H "$AUTH" -H 'Content-Type: application/json' -d "$BODY" \
+  "${MER_URL}/instances/${INST}/private/accounts/${H_WIRE}" \
+  -w "PATCH_HTTP=%{http_code}\n" -o /dev/null
+
+echo "=== restart wirewatch in merchant container ==="
+su - hernani -c 'podman exec taler-hacktivism bash -c "
+set +e
+for p in \$(ps -eo pid=,args= | awk \"\\\$0 ~ /\\/usr\\/bin\\/taler-merchant-wirewatch/ {print \\\$1}\"); do
+  kill \$p 2>/dev/null || true
+done
+sleep 1
+runuser -u taler-merchant-httpd -- nohup /usr/bin/taler-merchant-wirewatch \
+  -c /etc/taler-merchant/taler-merchant.conf -L INFO \
+  >>/var/log/taler-merchant/wirewatch.log 2>&1 &
+sleep 2
+ps -eo pid,etime,args | grep -E \"[t]aler-merchant-wirewatch\" || echo FAIL_no_wirewatch
+tail -8 /var/log/taler-merchant/wirewatch.log
+"'
+
+echo "=== private/transfers (sample) ==="
+curl -sk -H "$AUTH" "${MER_URL}/instances/${INST}/private/transfers" \
+  | python3 -c 'import sys,json;d=json.load(sys.stdin);t=d.get("transfers")or[];print("transfers",len(t))'
+
+echo OK_credit_facade